1. Legal Entity & Contact Details

2 Manor House Lane, Datchet, Slough, Berkshire, SL3 9EB, United Kingdom. Galaxy Travel Ltd is the data controller responsible for your personal data.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

Identity Data

• Full name
• Date of birth
• Passport details (where required for booking)

Contact Data

• Email address
• Phone number
• Billing address

Booking Data

• Flight details
• Travel preferences
• Booking history

Payment Data

• Payment transaction details (processed securely via third-party payment providers)
• We do not store full card details.

Technical Data

• IP address
• Browser type and version
• Device information
• Time zone setting

Marketing & Communications Data

• Marketing preferences
• Communication history
• Support queries

3. How We Collect Your Data

We collect data when you:

• Make a booking
• Contact customer support
• Subscribe to marketing communications
• Use our website (via cookies and analytics tools)

4. Lawful Basis for Processing

Contract Performance
To process flight bookings and provide travel services.

Legal Obligation
To comply with tax, accounting, and regulatory requirements.

Legitimate Interests
To improve services, prevent fraud, and manage business operations.

Consent
For sending marketing communications and placing non-essential cookies. You may withdraw consent at any time.

5. Data Retention

We retain personal data only as long as necessary:

• Booking records: up to 7 years (for legal and tax compliance)
• Customer support records: up to 12 months
• Marketing data: until you unsubscribe or withdraw consent
• Technical data: as required for analytics and security purposes

After retention periods expire, data is securely deleted or anonymized.

6. Data Sharing & Third Parties

We may share your data with:

• Airlines and travel service providers
• Payment processing providers
• IT and hosting service providers
• Customer support systems
• Marketing and analytics providers
• Legal and regulatory authorities (where required)

All third-party processors are contractually required to protect your data and process it only under our instructions.

7. International Data Transfers

Some of our third-party providers may be located outside the United Kingdom.

Where data is transferred internationally, we ensure appropriate safeguards such as:

• UK-approved Standard Contractual Clauses (SCCs)
• Adequacy regulations
• Binding Corporate Rules (where applicable)

8. Cookies & Tracking Technologies

We use cookies to:

• Enable website functionality
• Improve performance
• Analyse traffic
• Support marketing and advertising campaigns

You can manage or withdraw cookie consent through our cookie banner.

Types of cookies used:

• Essential cookies
• Analytics cookies
• Marketing cookies

You may disable cookies in your browser settings; however, some features may not function properly.

9. Special Category Data

We do not intentionally collect special category data (such as health or religious data) unless required for travel purposes (e.g., medical assistance requests).

Where such data is required, we process it only with explicit consent and limit its use strictly to booking-related purposes.

10. Your Data Protection Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time

To exercise your rights, please contact:

[email protected]

We aim to respond within one month.

11. Marketing Communications

We send marketing emails only where you have given consent or where permitted by law.

You may unsubscribe at any time by:

• Clicking the “unsubscribe” link in emails
• Contacting us at [email protected]

12. Security Measures

We implement appropriate technical and organizational measures including:

• SSL encryption (HTTPS)
• Secure payment gateways
• Access controls
• Staff confidentiality agreements
• Monitoring and fraud prevention systems

While we take strong precautions, no online system can be guaranteed 100% secure.

13. Children’s Data

Our website and services are not intended for individuals under the age of 18 without parental or guardian consent.

We do not knowingly collect personal data from children without appropriate authorization.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates will be published on this page with a revised effective date.